The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Hot answers tagged

23

That means certificate on the server has been expired or it is invalid. As for the workaround, use the LDAPTLS_REQCERT variable to ignore the certificate, e.g.: LDAPTLS_REQCERT=never ldapsearch -D "cn=drupal-test,ou=Services,dc=example,dc=com" -w my_pass -h ldap.example.com -b "ou=People,dc=example,dc=com" -s sub -x -ZZ "(uid=admin)" Otherwise you can ...


17

The sssd daemon acts as the spider in the web, controlling the login process and more. The login program communicates with the configured pam and nss modules, which in this case are provided by the SSSD package. These modules communicate with the corresponding SSSD responders, which in turn talk to the SSSD Monitor. SSSD looks up the user in the LDAP ...


14

This is what it is telling you: apparmor="DENIED" AppArmor denied something based on a profile (we'll get to that later). operation="open" The operation AppArmor denied (in this case opening something, probably a file). profile="/usr/sbin/ntpd" The profile that made AppArmor deny this action. name="/etc/ldap/ldap.conf" The file that something was ...


14

LDAP is a directory service (a type of database) along with a protocol that describes what information is stored, how to search it, etc. All kinds of things can be stored there, but in this case it'd be Unix user and group info. Very loosely, an alternative to /etc/passwd, /etc/shadow, /etc/group, and /etc/gshadow. Or to NIS. NSS is glibc's name service ...


13

This is exactly what pam_mkhomedir was made for. The pam_mkhomedir module can create the user's home directory upon login if that directory does not exist. How to install it depends upon your distribution. But you would need to put it in one or more files in /etc/pam.d. For example, on my system I have /etc/pam.d/system-login which is included by all other ...


9

From Debian Wiki: Since version 2.4.23-3 the configuration of OpenLDAP has been changed to /etc/ldap/slapd.d by default. So, OpenLDAP allow to configure itself dynamically through 'cn=config' tree. You can list DN in cn=config and see something like this: sudo ldapsearch -Y EXTERNAL -H ldapi:/// -b cn=config dn ... # {1}hdb, config dn: olcDatabase={1}...


9

phpldapadmin was removed from Debian Stretch in May because it was blocking the PHP 7 transition; that was fixed in August, but before it had time to migrate to Stretch, another serious bug was discovered. As a result, it is being kept out of Stretch. It is nevertheless possible to install phpldapadmin. I tried installing it locally and I didn't encounter ...


7

I'm not sure about the conversion from pem to cer, but to make ldapsearch use certs w/o having a ldap.conf or w/o the permissions to modify global certs you should be able to do this: env LDAPTLS_CACERT=/path/to/cert ldapsearch


7

Sorry about the long post, but it seems to work. I just had a typo in sudoers file. Took me a bit long to find it though, since the syntax was still correct but I couldn't execute any commands. However, it's working now. // Problem was that one ALL was missing, allowing me to execute no root cmds. %group1 ALL=(root) !/bin/su // Fixed it %group1 ALL=(...


6

Maybe AuthLDAPInitialBindAsUser (Apache 2.3.6) can help: Determines if the server does the initial DN lookup using the basic authentication users' own username, instead of anonymously or with hard-coded credentials for the server In combination with AuthLDAPInitialBindPattern, something like this might do the trick (untested): AuthType Basic ...


6

https://www.edubuntu.org/ seems to be popular amongst schools.... here is a list of where it is run: ==> https://wiki.edubuntu.org/Education/UbuntuSchools


6

For this you need to download/clone, compile and install nginx-auth-ldap You can download the zip file: wget https://github.com/kvspb/nginx-auth-ldap/archive/master.zip unzip master.zip then cd to your nginx source folder and do: ./configure --add-module=~-/nginx-auth-ldap-master sudo make install After that you can configure nginx: http { ...


6

This was enabled in sssd 1.9.5, by setting sssd.conf to include: ldap_rfc2307_fallback_to_local_users = true https://fedorahosted.org/sssd/wiki/Releases/Notes-1.9.5


5

With normal unix permissions, you can't do this. With ACLs you can (or should be able to). You need to be using a filesystem that supports ACLs. Most modern linux filesystems do. The basic command is setfacl In your example, if group B owns directory /B you would add access rights for group D as follows: setfacl -m group:B:rwx,group:D:rwx /B This is ...


5

The command you're looking for is called ldapsearch. It's a bit of a pain to use, though. Here are some usage examples: To get a full listing of all entries in the directory (depending on whether your server and/or network can handle this query): ldapsearch -h ldapserver.example.cm -b "dc=example,dc=com" -s sub "objectclass=*" To search for a particular ...


5

uid=tupac,ou=people,dc=maytacapac,dc=inc looks wrong, as most (okay, all except this one) LDAP-provided group memberships I've seen do not include a LDAP DN, and instead just the username, so I would expect to instead see adminsLinux:*:3000:tupac.


5

OpenLDAP supports two authentication methods (simple and SASL), while SASL is the default method for ldap-utils like ldapsearch. When you are authenticating using the DN, you do a so called "simple bind". simple bind The simple method has three modes of operation: anonymous unauthenticated user/password authenticated For example: # ldapwhoami -x ...


4

First look for pdbedit -u $username -v This should display every property about this particular user. pdbedit -P "maximum password age" -C -1 This then should disable the max password age for all accounts. Taken from: http://linuxcommand.org/man_pages/pdbedit8.html


4

First of all you should be aware of slapcat's limitations: For some backend types, your slapd(8) should not be running (at least, not in read-write mode) when you do this to ensure consistency of the database. It is always safe to run slapcat with the slapd-bdb(5), slapd-hdb(5), and slapd-null(5) backends. So you better pack that backup in /etc/init.d/...


4

You can see the client configuration which is stored in the /var/ldap directory by running the ldapclient list command, eg: # ldapclient list NS_LDAP_FILE_VERSION= 2.0 NS_LDAP_BINDDN= cn=proxyagent,ou=profile,dc=west,dc=example,dc=com NS_LDAP_BINDPASSWD= {NS1}4a3788e8c053424f NS_LDAP_SERVERS= 192.168.0.1, 192.168.0.10 NS_LDAP_SEARCH_BASEDN= dc=west,dc=...


4

Yes to both. ldapsearch -H ldap://ldap.mydomain.com -x -s base -b "" + # the + returns operational attributes will give a list of supported features. You may want to look up the meaning of the IOD's that get returned here. More interesting stuff is in the cn=Subschema section: ldapsearch -H ldap://ldap.mydomain.com -x -s base -b "cn=subschema" ...


4

ldapadduser set the user primary group which is unique. You should use ldapaddusertogroup for secondary ones.


4

In Ubuntu 14.04 system-login is not present, but another file named as common-session is present. I went there and put: root@GW:~# vim /etc/pam.d/common-session # session optional pam_systemd.so skel=/etc/skel/ umask=0077 This will create home directory if no exist also set the permission to 700


4

I've seen similar issues with gdm. The problem is not directly related to SDDM, it is related to a combination of the fact that LDAP users are unknown until we have access to the LDAP server, the fact that systemd was made the default init system in Debian Jessie (which adds massive parallellisation to startup) and the fact that, by default, there is no ...


4

svcadm restart ldap/client should do the trick. Depending on what you're running you might also need to restart filesystem/autofs


4

sudo nano /etc/phpldapadmin/templates/creation/posixAccount.xml The Home Directory isn't really part of the question :P, but its the only two things I modified, and I figured I'd include it! Works great now though! But for users whom have already logged into server, it didn't retroactivly fix it, even if I changed the values in phpldapadmin, they still got ...


4

A host netgroup contains a list of hosts. myhostnetgroup (server1) (server2) (server3) Refer to the manpage. If you want your netgroups in LDAP check here for some information. When you reference the netgroup in your sudo config, it will grant access to any of the hosts in the netgroup so you don't have to list them out explicitly.


4

Try chmod 600 /etc/sssd/sssd.conf (path to sssd.conf) and then restart sssd service (service sssd restart) sssd.conf should be run by root user with 0600 permission only. i.e your sssd.conf file should look like below root@proxy:/# ls -l /etc/sssd/sssd.conf -rw------- 1 root root 292 Mar 28 12:59 /etc/sssd/sssd.conf not with 770 permission root@...


4

The issue seems to persist in 17.04 (at least for me) This worked for me: sudo systemctl disable nmbd sudo systemctl disable smbd sudo systemctl unmask samba-ad-dc sudo systemctl enable samba-ad-dc


4

If you do: ldapsearch -h ... "'(&(this)(that="${Field1}"))'" The single quotes will be part of of the quoted string, and they will go to ldapsearch. Which doesn't expect them, giving the error. Also, the expansion of ${Field1} is unquoted, since the second double-quote ends the quoting. (Quotes don't nest.) Your other output looks like the output of ...


Only top voted, non community-wiki answers of a minimum length are eligible